Shared helper that emits the <head> freshness tags every
generator must include so the PWA layer (js/pwa-register.js) can:
Read the embedded build commit SHA + timestamp from <meta> tags.
Load the same-origin service-worker registration script.
Tell browsers + intermediate proxies to revalidate every navigation
(Cache-Control: no-cache, Pragma: no-cache).
Every value is HTML-escaped — BUILD_ID/BUILD_TIME are tightly
formatted (40-char hex / ISO 8601) but defence-in-depth is cheap.
The output is a multi-line string; callers should drop it into the
<head> block alongside other <meta> tags. CSP stays script-src 'self' because the only emitted <script> references a same-origin
file with a defer attribute.
Description
Shared helper that emits the
<head>freshness tags every generator must include so the PWA layer (js/pwa-register.js) can:<meta>tags.Cache-Control: no-cache,Pragma: no-cache).Every value is HTML-escaped —
BUILD_ID/BUILD_TIMEare tightly formatted (40-char hex / ISO 8601) but defence-in-depth is cheap.The output is a multi-line string; callers should drop it into the
<head>block alongside other<meta>tags. CSP staysscript-src 'self'because the only emitted<script>references a same-origin file with adeferattribute.